1325189 - [CID 1221158] Missing OOM check in stagefright::MetaData::setData

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Found by Coverity, CID 1221158.

In stagefright::MetaData::setData(): After `ssize_t i = ... mItems.add(key, item);`, i could now be negative in case of OOM when trying to add the key.

But anyway, going down the rabbit hole, the actual place where memory is (re)allocated in VectorImpl::_grow() is followed by an assert, so in case of OOM the program will crash before anything can be done with the finally-returned negative value!

For safety's sake, we should probably add a check in setData anyway, and if time permit see if there is a better way to deal with OOMs in the storage.

Comment 1

[James Cheng[:JamesCheng]]

Attachment: Bug 1325189 - [CID 1221158] Assertion when OOM instead of indexing array with negative value.

Review commit: https://reviewboard.mozilla.org/r/100398/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/100398/

Comment 2

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8821026 [details]
Bug 1325189 - [CID 1221158] Assertion when OOM instead of indexing array with negative value.

https://reviewboard.mozilla.org/r/100398/#review100998

Thank you for handling this one.

r+ with nits:

::: media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:197
(Diff revision 1)
>          i = mItems.add(key, item);
>  

Remove these redundant lines.

::: media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp:199
(Diff revision 1)
> +        // TODO: "i" will be negtive value when OOM,
> +        // we should consider to handle this case instead of assertion.

'negtive' -> 'negative'
'to handle' -> 'handling'
'assertion' -> 'asserting'

Comment 3

[James Cheng[:JamesCheng]]

Comment on attachment 8821026 [details]
Bug 1325189 - [CID 1221158] Assertion when OOM instead of indexing array with negative value.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/100398/diff/1-2/

Comment 4

[James Cheng[:JamesCheng]]

Thank you for pointing out! Thanks.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e594cf0fda6d
[CID 1221158] Assertion when OOM instead of indexing array with negative value. r=gerald

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e594cf0fda6d